Controlled Goods Program (CGP)

The Controlled Goods Program is the Government of Canada's domestic industrial security program, administered by Public Services and Procurement Canada (PSPC), that regulates who may examine, possess or transfer controlled goods within Canada. Registration is mandatory for that work — and for suppliers, the trigger most often met first in bidding is the rule that you must be registered before you can receive bid solicitation documents containing controlled goods.

What the program covers

The CGP derives its mandate from Part 2 of the Defence Production Act and the Controlled Goods Regulations (SOR/2001-32), which give the Minister of Public Services and Procurement authority to regulate the examination, possession and transfer of controlled goods in Canada. Controlled goods are primarily defence articles — including some components and their associated technical data such as blueprints or specifications — that have military or national security significance. The Controlled Goods List in the Schedule to the Defence Production Act is the domestic list, and it overlaps with goods defined on the United States Munitions List under the U.S. ITAR regime. The program is domestic: transferring controlled goods outside Canada is a separate matter requiring an export permit from Global Affairs Canada, though CGP registration comes first there too.

How registration works

Any individual or organization that needs to examine, possess or transfer controlled goods must register before starting that work, and must demonstrate the need during registration. The application names an authorized individual (usually the owner or a senior official) and designated officials, who undergo security assessments including criminal record checks; owners holding 20% or more of the outstanding voting shares are also security assessed. Registrants must develop a security plan for each place of business, complete mandatory designated-official training, keep records, report security breaches, and file a report every six months of all security-assessed individuals. There is no cost to register; PSPC's published processing standard is 32 business days (with a current advisory noting longer times amid a surge in applications). A certificate of registration is valid for a maximum of 5 years and is not transferrable between individuals or businesses.

Enforcement

Compliance is not optional paperwork. Failing to register where required may be treated as an offence under federal law, and it is an offence to knowingly transfer a controlled good to a person or business that is not registered or exempt. A person who fails to comply with the Defence Production Act can have their CGP registration suspended or revoked and face prosecution — with a fine of up to $2,000,000 and/or imprisonment of up to 10 years.

Common questions

Do I need CGP registration to bid on defence contracts?

Only if controlled goods are involved. The registration requirement attaches to examining, possessing or transferring controlled goods — and specifically to receiving bid solicitation documents containing controlled goods or controlled technology. Plenty of defence-sector procurements involve ordinary goods and services with no controlled-goods content; the solicitation itself tells you whether controlled goods are in scope, and suppliers who routinely bid on such work get registered in advance rather than discovering the requirement at document-access time.

Is CGP registration the same as a security clearance?

It is its own thing. CGP registration is a domestic program for the handling of controlled goods, built around organization registration, security assessments of specific individuals, and site security plans. Contract security clearances for classified contracts run through a different PSPC process. A company can hold one without the other, so check which one a solicitation actually demands rather than assuming either covers you.

What does registration cost?

Nothing to register — PSPC states there is no direct cost to register in the CGP. Budget instead for the administrative side of compliance: security assessments, criminal record checks, security-plan development and the ongoing record-keeping and reporting obligations.

Related definitions

Industrial security clearance · Designated organization screening (DOS) · Supplier registration · ITB (industrial and technological benefits)